1#
2# Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
3# Use is subject to license terms.
4#
5# ident	"%Z%%M%	%I%	%E% SMI"
6#
7
8The sendmail Mail Filter API (Milter) is designed to allow third-party
9programs access to mail messages as they are being processed in order to
10filter meta-information and content.
11
12This README file describes the steps needed to compile and run a filter,
13through reference to a sample filter which is attached at the end of this
14file.
15
16Note: if you want to write a milter in Java, then see
17http://sendmail-jilter.sourceforge.net/
18
19+----------------+
20| SECURITY HINTS |
21+----------------+
22
23Note: we strongly recommend not to run any milter as root.  Libmilter
24does not need root access to communicate with sendmail.  It is a
25good security practice to run a program only with root privileges
26if really necessary.  A milter should probably check first whether
27it runs as root and refuse to start in that case.  libmilter will
28not unlink a socket when running as root.
29
30+-------------------+
31| BUILDING A FILTER |
32+-------------------+
33
34The following command presumes that the sample code from the end of this
35README is saved to a file named 'sample.c'.
36
37	cc -D_REENTRANT -o sample sample.c -lmilter
38
39Filters must be thread-safe!
40
41Note that since filters use threads, it may be necessary to alter per
42process limits in your filter.  For example, you might look at using
43setrlimit() to increase the number of open file descriptors if your filter
44is going to be busy.
45
46
47+----------------------------------------+
48| SPECIFYING FILTERS IN SENDMAIL CONFIGS |
49+----------------------------------------+
50
51Filters are specified with a key letter ``X'' (for ``eXternal'').
52
53For example:
54
55	Xfilter1, S=local:/var/run/f1.sock, F=R
56	Xfilter2, S=inet6:999@localhost, F=T, T=C:10m;S:1s;R:1s;E:5m
57	Xfilter3, S=inet:3333@localhost
58
59specifies three filters.  Filters can be specified in your .mc file using
60the following:
61
62	INPUT_MAIL_FILTER(`filter1', `S=local:/var/run/f1.sock, F=R')
63	INPUT_MAIL_FILTER(`filter2', `S=inet6:999@localhost, F=T, T=C:10m;S:1s;R:1s;E:5m')
64	INPUT_MAIL_FILTER(`filter3', `S=inet:3333@localhost')
65
66The first attaches to a Unix-domain socket in the /var/run directory; the
67second uses an IPv6 socket on port 999 of localhost, and the third uses an
68IPv4 socket on port 3333 of localhost.  The current flags (F=) are:
69
70	R		Reject connection if filter unavailable
71	T		Temporary fail connection if filter unavailable
72	4		Shut down connection if filter unavailable
73			(with a 421 temporary error).
74
75If none of these is specified, the message is passed through sendmail
76in case of filter errors as if the failing filters were not present.
77
78Finally, you can override the default timeouts used by sendmail when
79talking to the filters using the T= equate.  There are four fields inside
80of the T= equate:
81
82Letter		Meaning
83  C		Timeout for connecting to a filter (if 0, use system timeout)
84  S		Timeout for sending information from the MTA to a filter
85  R		Timeout for reading reply from the filter
86  E		Overall timeout between sending end-of-message to filter
87		and waiting for the final acknowledgment
88
89Note the separator between each is a ';' as a ',' already separates equates
90and therefore can't separate timeouts.  The default values (if not set in
91the config) are:
92
93T=C:5m;S:10s;R:10s;E:5m
94
95where 's' is seconds and 'm' is minutes.
96
97Which filters are invoked and their sequencing is handled by the
98InputMailFilters option. Note: if InputMailFilters is not defined no filters
99will be used.
100
101	O InputMailFilters=filter1, filter2, filter3
102
103This is is set automatically according to the order of the
104INPUT_MAIL_FILTER commands in your .mc file.  Alternatively, you can
105reset its value by setting confINPUT_MAIL_FILTERS in your .mc file.
106This options causes the three filters to be called in the same order
107they were specified.  It allows for possible future filtering on output
108(although this is not intended for this release).
109
110Also note that a filter can be defined without adding it to the input
111filter list by using MAIL_FILTER() instead of INPUT_MAIL_FILTER() in your
112.mc file.
113
114To test sendmail with the sample filter, the following might be added (in
115the appropriate locations) to your .mc file:
116
117	INPUT_MAIL_FILTER(`sample', `S=local:/var/run/f1.sock')
118
119
120+------------------+
121| TESTING A FILTER |
122+------------------+
123
124Once you have compiled a filter, modified your .mc file and restarted
125the sendmail process, you will want to test that the filter performs as
126intended.
127
128The sample filter takes one argument -p, which indicates the local port
129on which to create a listening socket for the filter.  Maintaining
130consistency with the suggested options for sendmail.cf, this would be the
131UNIX domain socket located in /var/run/f1.sock.
132
133	% ./sample -p local:/var/run/f1.sock
134
135If the sample filter returns immediately to a command line, there was either
136an error with your command or a problem creating the specified socket.
137Further logging can be captured through the syslogd daemon.  Using the
138'netstat -a' command can ensure that your filter process is listening on
139the appropriate local socket.
140
141Email messages must be injected via SMTP to be filtered.  There are two
142simple means of doing this; either using the 'sendmail -bs' command, or
143by telnetting to port 25 of the machine configured for milter.  Once
144connected via one of these options, the session can be continued through
145the use of standard SMTP commands.
146
147% sendmail -bs
148220 test.sendmail.com ESMTP Sendmail 8.14.0/8.14.0; Thu, 22 Jun 2006 13:05:23 -0500 (EST)
149HELO localhost
150250 test.sendmail.com Hello testy@localhost, pleased to meet you
151MAIL From:<testy>
152250 2.1.0 <testy>... Sender ok
153RCPT To:<root>
154250 2.1.5 <root>... Recipient ok
155DATA
156354 Enter mail, end with "." on a line by itself
157From: testy@test.sendmail.com
158To: root@test.sendmail.com
159Subject: testing sample filter
160
161Sample body
162.
163250 2.0.0 dB73Zxi25236 Message accepted for delivery
164QUIT
165221 2.0.0 test.sendmail.com closing connection
166
167In the above example, the lines beginning with numbers are output by the
168mail server, and those without are your input.  If everything is working
169properly, you will find a file in /tmp by the name of msg.XXXXXXXX (where
170the Xs represent any combination of letters and numbers).  This file should
171contain the message body and headers from the test email entered above.
172
173If the sample filter did not log your test email, there are a number of
174methods to narrow down the source of the problem.  Check your system
175logs written by syslogd and see if there are any pertinent lines.  You
176may need to reconfigure syslogd to capture all relevant data.  Additionally,
177the logging level of sendmail can be raised with the LogLevel option.
178See the sendmail(8) manual page for more information.
179
180
181$Revision: 8.42 $, Last updated $Date: 2006/06/29 17:10:16 $
182